Azure Compliance ControlsAzure Storage
Storage accounts should each have 'Enable key rotation reminders' enabled
Azure Storage accounts must define a `key expiration period` for access-key rotation, set to a maximum of 90 days. The check flags any account that has no key expiration period configured or that sets a period longer than 90 days.
What this control checks
Storage account key expiration period is 90 days or less
Framework mappings
The clauses this control is mapped to in each framework.
- 9 Cryptography
- 11 Access control
- 12 Asset management
- 10.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 10.3.1.2 Ensure that Storage Account access keys are periodically regenerated
- 9.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 9.3.1.2 Ensure that Storage Account access keys are periodically regenerated
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this...
- CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited.
2 more clauses
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 3.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 3.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 3.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 3.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 4.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 4.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 164.308(a)(5)(ii)(D): Administrative Safeguards
Related controls
- Storage accounts should use Microsoft-managed key for encryption
- RBAC key vaults should have 'Expiration Date' configured for all secrets
- Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
- Storage accounts should have soft delete enabled
- Storage accounts should have soft delete enabled for both blobs and containers
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_key_rotation_reminder_enabled - Powerpipe Control:
azure_compliance.control.storage_account_key_rotation_reminder_enabled - Prowler Check:
storage_key_rotation_90_days
Last reviewed: 2026-10-15